It sounds like what he did had exactly the same effect as "using simple HTML injection to add a rick roll to something".
'But he achieved it using leet hacker skills' should not be a factor in determining the nature of the charge or potential sentence. That's along the lines of making a big deal out of someone using a "Subversion" system to access and maintain code.
By "using simple HTML injection" I'm thinking of a form where they don't sanitize input so you could put a <video> tag in the 'name' field and suddenly the video would appear on the page.
Getting access to the administrator account is pretty different.
Not for a high school student. School networks tend to be very insecure, and the students tend to see them as just another resource in their education.
'But he achieved it using leet hacker skills' should not be a factor in determining the nature of the charge or potential sentence. That's along the lines of making a big deal out of someone using a "Subversion" system to access and maintain code.